ALSA: usx2y: Use snd_card_free_when_closed() at disconnection

BugLink: https://bugs.launchpad.net/bugs/2101915

[ Upstream commit dafb28f02be407e07a6f679e922a626592b481b0 ]

The USB disconnect callback is supposed to be short and not too-long
waiting.  OTOH, the current code uses snd_card_free() at
disconnection, but this waits for the close of all used fds, hence it
can take long.  It eventually blocks the upper layer USB ioctls, which
may trigger a soft lockup.

An easy workaround is to replace snd_card_free() with
snd_card_free_when_closed().  This variant returns immediately while
the release of resources is done asynchronously by the card device
release at the last close.

Fixes: 230cd5e248 ("[ALSA] prevent oops & dead keyboard on usb unplugging while the device is be ing used")
Reported-by: syzbot+73582d08864d8268b6fd@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=73582d08864d8268b6fd
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20241113111042.15058-2-tiwai@suse.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
CVE-2024-56533
Signed-off-by: Koichiro Den <koichiro.den@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

This commit is contained in:

Takashi Iwai

2025-03-11 08:51:19 +09:00

committed by

Stefan Bader

parent 833c85afa5

commit 89b418b411

1 changed files with 1 additions and 1 deletions

									
										sound/usb/usx2y/usbusx2y.c
									
		+1
		-1
	
												View File
												
				@@ -423,7 +423,7 @@ static void snd_usx2y_disconnect(struct usb_interface *intf)

					}

					if (usx2y->us428ctls_sharedmem)

						wake_up(&usx2y->us428ctls_wait_queue_head);

					snd_card_free(card);

					snd_card_free_when_closed(card);

				}

				static int snd_usx2y_probe(struct usb_interface *intf,